Invoke-ThreatIntelCheck.ps1

#Requires -Version 5.1
<#
.SYNOPSIS
    Multi-Source Threat Intelligence Checker

.DESCRIPTION
    Checks IP addresses, domains, URLs, and SHA256 file hashes against
    multiple free threat intelligence sources.

    Output is Splunk-friendly key=value pairs written to stdout, one event
    per line, suitable for SIEM ingestion or file redirection.

    All prompts and diagnostic messages are written to the host (stderr) so
    the two streams never mix. Redirect stdout to a log file while status
    messages continue to display in your terminal.

    Supported sources:
        VirusTotal v3       - IP, domain, URL, SHA256  (API key required)
        AbuseIPDB v2        - IP                        (API key required)
        URLScan.io          - URL, domain               (API key required)
        Shodan InternetDB   - IP                        (no key)
        IPinfo.io           - IP                        (no key, basic data)
        GreyNoise Community - IP                        (no key)
        CIRCL hashlookup    - SHA256                    (no key)
        OS: dig / nslookup  - Domain, URL               (no key)
        OS: whois           - IP, domain                (no key)

.PARAMETER Indicators
    One or more indicators to check (IP, domain, URL, or SHA256 hash).
    When calling from a Unix shell, use spaces only to separate indicators.
    Example: pwsh script.ps1 -Indicators 1.2.3.4 evil.com

.PARAMETER File
    Path to a file containing indicators, one per line.
    Lines starting with '#' are treated as comments and skipped.

.PARAMETER Config
    Path to the INI config file containing API keys.
    Default: threat_intel.conf in the same directory as this script.

.PARAMETER Menu
    Launch interactive menu-driven mode (default when no parameters are given).

.EXAMPLE
    # Windows PowerShell / PowerShell 7
    .\Invoke-ThreatIntelCheck.ps1 -Indicators 203.0.113.5
    .\Invoke-ThreatIntelCheck.ps1 -Indicators 203.0.113.5 evil.example.com
    .\Invoke-ThreatIntelCheck.ps1 -File .\iocs.txt
    .\Invoke-ThreatIntelCheck.ps1 -File .\iocs.txt | Out-File events.log
    .\Invoke-ThreatIntelCheck.ps1 -Menu

    # Linux / FreeBSD (pwsh)
    pwsh Invoke-ThreatIntelCheck.ps1 -Indicators 203.0.113.5
    pwsh Invoke-ThreatIntelCheck.ps1 -Indicators 203.0.113.5 evil.example.com
    pwsh Invoke-ThreatIntelCheck.ps1 -File iocs.txt

.NOTES
    Author  : Geoffrey Edmund Moraes
    Version : 1.1.0
    License : MIT
    Requires: PowerShell 5.1+  (Windows PowerShell or PowerShell 7+)
    Platform: Windows, Linux, FreeBSD (any platform running PowerShell 5.1+)
#>

[CmdletBinding(DefaultParameterSetName = 'Menu')]
param(
    [Parameter(ParameterSetName = 'Direct', ValueFromRemainingArguments = $true)]
    [string[]] $Indicators,

    [Parameter(ParameterSetName = 'FromFile')]
    [string] $File,

    [Parameter(ParameterSetName = 'Menu')]
    [switch] $Menu,

    [string] $Config = (Join-Path $PSScriptRoot 'threat_intel.conf')
)

# StrictMode is intentionally limited to Version 1 here.
# Version Latest / Version 2 throws on any missing PSCustomObject property,
# which breaks every API response handler when optional fields are absent.
# Version 1 catches real issues (uninitialised variables, bad syntax) without
# the false positives that come from variable JSON response shapes.
Set-StrictMode -Version 1
$ErrorActionPreference = 'Continue'

# ---------------------------------------------------------------------------
# Constants
# ---------------------------------------------------------------------------

$SCRIPT_VERSION = '1.1.0'
$SCRIPT_NAME    = 'ThreatIntelChecker'
$HOSTNAME       = [System.Net.Dns]::GetHostName()
$TIMEOUT_SEC    = 15
$USER_AGENT     = "ThreatIntelChecker/$SCRIPT_VERSION (SOC Automation Tool)"

# ---------------------------------------------------------------------------
# Core helpers
# ---------------------------------------------------------------------------

function Get-SafeProp {
    <#
    .SYNOPSIS
        Safely retrieve a property value from any object without throwing.
        Uses PSObject.Properties so it never touches a property that does not
        exist, which would throw under StrictMode with PSCustomObjects.
    #>
    param(
        $Object,
        [string] $Property,
        $Default = ''
    )
    if ($null -eq $Object) { return $Default }
    $entry = $Object.PSObject.Properties[$Property]
    if ($null -eq $entry) { return $Default }
    $val = $entry.Value
    if ($null -eq $val -or "$val" -eq '') { return $Default }
    return $val
}

function Get-SafeInt {
    <#
    .SYNOPSIS
        Safely retrieve an integer property, returning 0 when absent or null.
    #>
    param($Object, [string] $Property)
    if ($null -eq $Object) { return 0 }
    $entry = $Object.PSObject.Properties[$Property]
    if ($null -eq $entry -or $null -eq $entry.Value) { return 0 }
    return [int]$entry.Value
}

function Get-UtcTimestamp {
    # Get-Date -AsUTC is PS 7+ only. [DateTime]::UtcNow works on PS 5.1+.
    return [DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ')
}

# ---------------------------------------------------------------------------
# Config loader
# ---------------------------------------------------------------------------

function Get-ThreatIntelConfig {
    param([string] $ConfigPath)

    $keys = @{
        VT_API_KEY        = ''
        ABUSEIPDB_API_KEY = ''
        URLSCAN_API_KEY   = ''
    }

    if (Test-Path $ConfigPath) {
        $inSection = $false
        foreach ($line in (Get-Content $ConfigPath -ErrorAction SilentlyContinue)) {
            $trimmed = $line.Trim()
            if ($trimmed -eq '[API_KEYS]')    { $inSection = $true;  continue }
            if ($trimmed -match '^\[')         { $inSection = $false; continue }
            if ($inSection -and $trimmed -match '^([^#=]+?)\s*=\s*(.*)$') {
                $k = $Matches[1].Trim().ToUpper()
                $v = $Matches[2].Trim()
                if ($keys.ContainsKey($k)) { $keys[$k] = $v }
            }
        }
    } else {
        Write-Host "INFO: Config file '$ConfigPath' not found. Falling back to environment variables only." -ForegroundColor Yellow
    }

    foreach ($k in @($keys.Keys)) {
        $envVal = [System.Environment]::GetEnvironmentVariable($k)
        if ($envVal) { $keys[$k] = $envVal.Trim() }
    }

    return $keys
}

# ---------------------------------------------------------------------------
# Input validation
# ---------------------------------------------------------------------------

function Get-IndicatorType {
    param([string] $Raw)

    $value = $Raw.Trim().Trim(',')
    if (-not $value) { return $null }

    # SHA256 - check before domain to avoid misclassifying 64-char hex strings
    if ($value -match '^[a-fA-F0-9]{64}$') {
        return @{ Type = 'sha256'; Value = $value.ToLower() }
    }

    # URL
    if ($value -match '^https?://\S+') {
        try {
            $uri = New-Object System.Uri($value)
            if ($uri.Host) { return @{ Type = 'url'; Value = $value } }
        } catch {}
        return $null
    }

    # IPv4
    if ($value -match '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$') {
        try {
            $ip    = [System.Net.IPAddress]::Parse($value)
            $bytes = $ip.GetAddressBytes()
            $priv  = (
                ($bytes[0] -eq 10) -or
                ($bytes[0] -eq 127) -or
                ($bytes[0] -eq 169 -and $bytes[1] -eq 254) -or
                ($bytes[0] -eq 172 -and $bytes[1] -ge 16 -and $bytes[1] -le 31) -or
                ($bytes[0] -eq 192 -and $bytes[1] -eq 168) -or
                ($bytes[0] -eq 0) -or
                ($bytes[0] -eq 255)
            )
            if ($priv) { return @{ Type = 'ip_private'; Value = $value } }
            return @{ Type = 'ip'; Value = $value }
        } catch { return $null }
    }

    # IPv6
    try {
        $ip6 = [System.Net.IPAddress]::Parse($value)
        if ($ip6.AddressFamily -eq [System.Net.Sockets.AddressFamily]::InterNetworkV6) {
            $s    = $ip6.ToString()
            $priv = ($s -match '^::1$' -or $s -match '^fe80:' -or
                     $s -match '^fc'   -or $s -match '^fd')
            if ($priv) { return @{ Type = 'ip_private'; Value = $value } }
            return @{ Type = 'ip'; Value = $value }
        }
    } catch {}

    # Domain
    if ($value -match '^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$' `
        -and $value -notmatch '\.\.') {
        return @{ Type = 'domain'; Value = $value.ToLower() }
    }

    return $null
}

# ---------------------------------------------------------------------------
# Output helpers
# ---------------------------------------------------------------------------

function Format-KVEvent {
    param([System.Collections.Specialized.OrderedDictionary] $Fields)

    $parts = foreach ($k in $Fields.Keys) {
        $v = [string]$Fields[$k]
        if ($v -match '[ =",'']') {
            $v = '"' + $v.Replace('\', '\\').Replace('"', '\"') + '"'
        }
        if ($v -eq '') { $v = '""' }
        "$k=$v"
    }
    return ($parts -join ' ')
}

function Emit-Event {
    param(
        [string]    $IndicatorType,
        [string]    $Indicator,
        [string]    $Source,
        [hashtable] $Fields,
        [string]    $Verdict = 'unknown'
    )

    $base = [ordered]@{
        timestamp      = (Get-UtcTimestamp)
        host           = $HOSTNAME
        app            = $SCRIPT_NAME
        version        = $SCRIPT_VERSION
        indicator_type = $IndicatorType
        indicator      = $Indicator
        source         = $Source
        verdict        = $Verdict
    }
    foreach ($k in $Fields.Keys) { $base[$k] = $Fields[$k] }

    [Console]::Out.WriteLine((Format-KVEvent -Fields $base))
}

function Emit-Error {
    param([string] $IndicatorType, [string] $Indicator, [string] $Source, [string] $ErrorMsg)
    Emit-Event -IndicatorType $IndicatorType -Indicator $Indicator -Source $Source `
               -Fields @{ error = $ErrorMsg } -Verdict 'error'
}

# ---------------------------------------------------------------------------
# HTTP helper
# ---------------------------------------------------------------------------

function Invoke-TIRequest {
    param(
        [string]    $Uri,
        [string]    $Method   = 'GET',
        [hashtable] $Headers  = @{},
        [hashtable] $Body     = @{},
        [hashtable] $Query    = @{},
        [bool]      $FormBody = $false
    )

    if ($Query.Count -gt 0) {
        $qs  = ($Query.Keys | ForEach-Object { "$_=$([Uri]::EscapeDataString($Query[$_]))" }) -join '&'
        $Uri = "${Uri}?${qs}"
    }

    $Headers['User-Agent'] = $USER_AGENT

    $irm = @{
        Uri         = $Uri
        Method      = $Method
        Headers     = $Headers
        TimeoutSec  = $TIMEOUT_SEC
        ErrorAction = 'Stop'
    }

    if ($Method -in 'POST', 'PUT') {
        if ($FormBody) {
            $irm.Body        = $Body
            $irm.ContentType = 'application/x-www-form-urlencoded'
        } else {
            $irm.Body        = ($Body | ConvertTo-Json -Compress)
            $irm.ContentType = 'application/json'
        }
    }

    try {
        return Invoke-RestMethod @irm
    } catch {
        return $null
    }
}

# ---------------------------------------------------------------------------
# OS-level enrichment (no API key required)
# ---------------------------------------------------------------------------

function Invoke-OsDnsLookup {
    param([string] $Target)

    $fields = @{}

    if (Get-Command dig -ErrorAction SilentlyContinue) {
        $out = & dig +short $Target A 2>$null
        if (-not $out) { $out = & dig +short -x $Target 2>$null }
        if ($out) {
            $resolved = ($out -split "`n" | Where-Object { $_.Trim() } | Select-Object -First 10)
            $fields['dns_resolved'] = ($resolved -join ',')
            return $fields
        }
    }

    if (Get-Command nslookup -ErrorAction SilentlyContinue) {
        $out = (& nslookup $Target 2>$null) | Out-String
        $m   = [regex]::Match($out, 'Address(?:es)?:\s*(.+)')
        if ($m.Success) { $fields['dns_resolved'] = $m.Groups[1].Value.Trim() }
    }

    return $fields
}

function Invoke-OsWhois {
    param([string] $Indicator)

    $fields = @{}
    if (-not (Get-Command whois -ErrorAction SilentlyContinue)) { return $fields }

    try { $out = (& whois $Indicator 2>$null) | Out-String }
    catch { return $fields }

    $patterns = @{
        whois_registrar = 'Registrar:\s*(.+)'
        whois_created   = '(?:Creation Date|Created(?:\s+On)?|Registered):\s*(.+)'
        whois_expires   = '(?:Registry Expiry Date|Expir(?:ation|es|y) Date?):\s*(.+)'
        whois_country   = '(?m)^country:\s*(.+)'
        whois_org       = '(?:org-name|OrgName|Organisation|Organization):\s*(.+)'
        whois_netname   = '(?m)^netname:\s*(.+)'
        whois_cidr      = '(?:CIDR|inetnum|NetRange):\s*(.+)'
    }
    foreach ($field in $patterns.Keys) {
        $m = [regex]::Match($out, $patterns[$field],
             [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
        if ($m.Success) {
            $v = $m.Groups[1].Value.Trim()
            if ($v.Length -gt 120) { $v = $v.Substring(0, 120) }
            $fields[$field] = $v
        }
    }
    return $fields
}

# ---------------------------------------------------------------------------
# API: VirusTotal v3
# ---------------------------------------------------------------------------

function Get-VTVerdict {
    param([int] $Malicious, [int] $Suspicious, [int] $Harmless, [int] $Undetected)
    if ($Malicious  -gt 0)                    { return 'malicious'  }
    if ($Suspicious -gt 0)                    { return 'suspicious' }
    if (($Harmless + $Undetected) -gt 0)      { return 'clean'      }
    return 'unknown'
}

function Invoke-VTIpCheck {
    param([string] $Ip, [string] $ApiKey)
    if (-not $ApiKey) { return }

    $resp = Invoke-TIRequest -Uri "https://www.virustotal.com/api/v3/ip_addresses/$Ip" `
                             -Headers @{ 'x-apikey' = $ApiKey }
    if (-not $resp) { Emit-Error 'ip' $Ip 'virustotal' 'request_failed'; return }

    $attrs = Get-SafeProp $resp.data 'attributes'
    $las   = Get-SafeProp $attrs    'last_analysis_stats'
    $mal   = Get-SafeInt  $las      'malicious'
    $sus   = Get-SafeInt  $las      'suspicious'
    $har   = Get-SafeInt  $las      'harmless'
    $und   = Get-SafeInt  $las      'undetected'

    Emit-Event 'ip' $Ip 'virustotal' @{
        vt_malicious  = $mal
        vt_suspicious = $sus
        vt_harmless   = $har
        vt_undetected = $und
        vt_country    = (Get-SafeProp $attrs 'country')
        vt_asn        = (Get-SafeProp $attrs 'asn')
        vt_as_owner   = (Get-SafeProp $attrs 'as_owner')
        vt_reputation = (Get-SafeProp $attrs 'reputation')
    } (Get-VTVerdict $mal $sus $har $und)
}

function Invoke-VTDomainCheck {
    param([string] $Domain, [string] $ApiKey)
    if (-not $ApiKey) { return }

    $resp = Invoke-TIRequest -Uri "https://www.virustotal.com/api/v3/domains/$Domain" `
                             -Headers @{ 'x-apikey' = $ApiKey }
    if (-not $resp) { Emit-Error 'domain' $Domain 'virustotal' 'request_failed'; return }

    $attrs = Get-SafeProp $resp.data 'attributes'
    $las   = Get-SafeProp $attrs    'last_analysis_stats'
    $mal   = Get-SafeInt  $las      'malicious'
    $sus   = Get-SafeInt  $las      'suspicious'
    $har   = Get-SafeInt  $las      'harmless'
    $und   = Get-SafeInt  $las      'undetected'

    # categories is a nested object whose values are the category strings
    $cats    = ''
    $catsObj = Get-SafeProp $attrs 'categories'
    if ($null -ne $catsObj -and $catsObj -is [PSCustomObject]) {
        $catVals = $catsObj.PSObject.Properties | Select-Object -First 5 | ForEach-Object { $_.Value }
        $cats    = ($catVals -join ',')
    }

    Emit-Event 'domain' $Domain 'virustotal' @{
        vt_malicious     = $mal
        vt_suspicious    = $sus
        vt_harmless      = $har
        vt_undetected    = $und
        vt_reputation    = (Get-SafeProp $attrs 'reputation')
        vt_categories    = $cats
        vt_registrar     = (Get-SafeProp $attrs 'registrar')
        vt_creation_date = (Get-SafeProp $attrs 'creation_date')
    } (Get-VTVerdict $mal $sus $har $und)
}

function Invoke-VTUrlCheck {
    param([string] $Url, [string] $ApiKey)
    if (-not $ApiKey) { return }

    $bytes = [System.Text.Encoding]::UTF8.GetBytes($Url)
    $urlId = [System.Convert]::ToBase64String($bytes).Replace('+','-').Replace('/','_').TrimEnd('=')

    $resp = Invoke-TIRequest -Uri "https://www.virustotal.com/api/v3/urls/$urlId" `
                             -Headers @{ 'x-apikey' = $ApiKey }
    if (-not $resp) { Emit-Error 'url' $Url 'virustotal' 'request_failed'; return }

    $attrs    = Get-SafeProp $resp.data 'attributes'
    $las      = Get-SafeProp $attrs    'last_analysis_stats'
    $mal      = Get-SafeInt  $las      'malicious'
    $sus      = Get-SafeInt  $las      'suspicious'
    $har      = Get-SafeInt  $las      'harmless'
    $und      = Get-SafeInt  $las      'undetected'
    $finalUrl = [string](Get-SafeProp $attrs 'last_final_url')
    $title    = [string](Get-SafeProp $attrs 'title')

    if ($finalUrl.Length -gt 200) { $finalUrl = $finalUrl.Substring(0, 200) }
    if ($title.Length    -gt 100) { $title    = $title.Substring(0, 100)    }

    Emit-Event 'url' $Url 'virustotal' @{
        vt_malicious  = $mal
        vt_suspicious = $sus
        vt_harmless   = $har
        vt_undetected = $und
        vt_final_url  = $finalUrl
        vt_title      = $title
    } (Get-VTVerdict $mal $sus $har $und)
}

function Invoke-VTHashCheck {
    param([string] $Hash, [string] $ApiKey)
    if (-not $ApiKey) { return }

    $resp = Invoke-TIRequest -Uri "https://www.virustotal.com/api/v3/files/$Hash" `
                             -Headers @{ 'x-apikey' = $ApiKey }
    if (-not $resp) { Emit-Error 'sha256' $Hash 'virustotal' 'request_failed'; return }

    $attrs = Get-SafeProp $resp.data 'attributes'
    $las   = Get-SafeProp $attrs    'last_analysis_stats'
    $mal   = Get-SafeInt  $las      'malicious'
    $sus   = Get-SafeInt  $las      'suspicious'
    $har   = Get-SafeInt  $las      'harmless'
    $und   = Get-SafeInt  $las      'undetected'

    $names    = ''
    $namesVal = Get-SafeProp $attrs 'names'
    if ($null -ne $namesVal) { $names = ($namesVal | Select-Object -First 3) -join ',' }

    Emit-Event 'sha256' $Hash 'virustotal' @{
        vt_malicious       = $mal
        vt_suspicious      = $sus
        vt_harmless        = $har
        vt_undetected      = $und
        vt_file_type       = (Get-SafeProp $attrs 'type_description')
        vt_file_name       = $names
        vt_file_size       = (Get-SafeProp $attrs 'size')
        vt_meaningful_name = (Get-SafeProp $attrs 'meaningful_name')
        vt_first_seen      = (Get-SafeProp $attrs 'first_submission_date')
        vt_last_seen       = (Get-SafeProp $attrs 'last_analysis_date')
    } (Get-VTVerdict $mal $sus $har $und)
}

# ---------------------------------------------------------------------------
# API: AbuseIPDB v2
# ---------------------------------------------------------------------------

function Invoke-AbuseIPDBCheck {
    param([string] $Ip, [string] $ApiKey)
    if (-not $ApiKey) { return }

    $resp = Invoke-TIRequest `
        -Uri     'https://api.abuseipdb.com/api/v2/check' `
        -Headers @{ 'Key' = $ApiKey; 'Accept' = 'application/json' } `
        -Query   @{ ipAddress = $Ip; maxAgeInDays = '90' }

    if (-not $resp) { Emit-Error 'ip' $Ip 'abuseipdb' 'request_failed'; return }

    $d     = Get-SafeProp $resp 'data'
    $score = Get-SafeInt  $d   'abuseConfidenceScore'

    $verdict = 'clean'
    if ($score -ge 75)     { $verdict = 'malicious'  }
    elseif ($score -ge 25) { $verdict = 'suspicious' }

    $isp = [string](Get-SafeProp $d 'isp')
    if ($isp.Length -gt 100) { $isp = $isp.Substring(0, 100) }

    Emit-Event 'ip' $Ip 'abuseipdb' @{
        abuseipdb_score              = $score
        abuseipdb_total_reports      = (Get-SafeInt  $d 'totalReports')
        abuseipdb_num_distinct_users = (Get-SafeInt  $d 'numDistinctUsers')
        abuseipdb_country            = (Get-SafeProp $d 'countryCode')
        abuseipdb_isp                = $isp
        abuseipdb_usage_type         = (Get-SafeProp $d 'usageType')
        abuseipdb_domain             = (Get-SafeProp $d 'domain')
        abuseipdb_is_tor             = (Get-SafeProp $d 'isTor' $false)
        abuseipdb_last_reported      = (Get-SafeProp $d 'lastReportedAt')
    } $verdict
}

# ---------------------------------------------------------------------------
# API: Shodan InternetDB (no key)
# ---------------------------------------------------------------------------

function Invoke-ShodanInternetDBCheck {
    param([string] $Ip)

    $resp = Invoke-TIRequest -Uri "https://internetdb.shodan.io/$Ip"
    if (-not $resp) { Emit-Error 'ip' $Ip 'shodan_internetdb' 'request_failed'; return }

    # 404 responses include a 'detail' field; use Get-SafeProp so strict mode
    # does not throw when 'detail' is absent on a normal 200 response
    $detail = Get-SafeProp $resp 'detail'
    if ($detail) {
        Emit-Event 'ip' $Ip 'shodan_internetdb' @{ result = 'not_found' } 'unknown'
        return
    }

    $vulns = @()
    $ports = @()
    $hosts = @()
    $cpes  = @()
    $tags  = @()

    $vulnsVal = Get-SafeProp $resp 'vulns'
    $portsVal = Get-SafeProp $resp 'ports'
    $hostsVal = Get-SafeProp $resp 'hostnames'
    $cpesVal  = Get-SafeProp $resp 'cpes'
    $tagsVal  = Get-SafeProp $resp 'tags'

    if ($null -ne $vulnsVal) { $vulns = @($vulnsVal) }
    if ($null -ne $portsVal) { $ports = @($portsVal) }
    if ($null -ne $hostsVal) { $hosts = @($hostsVal) }
    if ($null -ne $cpesVal)  { $cpes  = @($cpesVal)  }
    if ($null -ne $tagsVal)  { $tags  = @($tagsVal)  }

    $verdict = 'clean'
    if ($vulns.Count -gt 0) { $verdict = 'suspicious' }

    Emit-Event 'ip' $Ip 'shodan_internetdb' @{
        shodan_open_ports = (($ports | Select-Object -First 20) -join ',')
        shodan_hostnames  = (($hosts | Select-Object -First 5)  -join ',')
        shodan_vulns      = (($vulns | Select-Object -First 10) -join ',')
        shodan_cpes       = (($cpes  | Select-Object -First 5)  -join ',')
        shodan_tags       = ($tags -join ',')
    } $verdict
}

# ---------------------------------------------------------------------------
# API: IPinfo.io (no key for basic data)
# ---------------------------------------------------------------------------

function Invoke-IPinfoCheck {
    param([string] $Ip)

    $resp = Invoke-TIRequest -Uri "https://ipinfo.io/$Ip/json"
    if (-not $resp) { Emit-Error 'ip' $Ip 'ipinfo' 'request_failed'; return }

    $org = [string](Get-SafeProp $resp 'org')
    if ($org.Length -gt 100) { $org = $org.Substring(0, 100) }

    Emit-Event 'ip' $Ip 'ipinfo' @{
        ipinfo_org      = $org
        ipinfo_country  = (Get-SafeProp $resp 'country')
        ipinfo_region   = (Get-SafeProp $resp 'region')
        ipinfo_city     = (Get-SafeProp $resp 'city')
        ipinfo_timezone = (Get-SafeProp $resp 'timezone')
        ipinfo_hostname = (Get-SafeProp $resp 'hostname')
        ipinfo_bogon    = (Get-SafeProp $resp 'bogon' $false)
    } 'unknown'
}

# ---------------------------------------------------------------------------
# API: GreyNoise Community (no key)
# ---------------------------------------------------------------------------

function Invoke-GreyNoiseCheck {
    param([string] $Ip)

    $resp = Invoke-TIRequest -Uri "https://api.greynoise.io/v3/community/$Ip"
    if (-not $resp) { Emit-Error 'ip' $Ip 'greynoise' 'request_failed'; return }

    $classification = [string](Get-SafeProp $resp 'classification' 'unknown')
    $noise          = (Get-SafeProp $resp 'noise' $false)
    $riot           = (Get-SafeProp $resp 'riot'  $false)
    $name           = [string](Get-SafeProp $resp 'name')
    $lastSeen       = [string](Get-SafeProp $resp 'last_seen')
    $message        = [string](Get-SafeProp $resp 'message')

    if ($name.Length    -gt 100) { $name    = $name.Substring(0, 100)    }
    if ($message.Length -gt 200) { $message = $message.Substring(0, 200) }

    # IP not observed by GreyNoise: response has only a message field
    if ($classification -eq 'unknown' -and -not $noise -and -not $riot -and $message) {
        Emit-Event 'ip' $Ip 'greynoise' @{
            result     = 'not_observed'
            gn_message = $message
        } 'unknown'
        return
    }

    $verdict = 'unknown'
    if     ($classification -eq 'malicious') { $verdict = 'malicious'  }
    elseif ($classification -eq 'benign')    { $verdict = 'clean'      }
    elseif ($noise -and -not $riot)          { $verdict = 'suspicious' }

    Emit-Event 'ip' $Ip 'greynoise' @{
        gn_noise          = $noise
        gn_riot           = $riot
        gn_classification = $classification
        gn_name           = $name
        gn_last_seen      = $lastSeen
        gn_message        = $message
    } $verdict
}

# ---------------------------------------------------------------------------
# API: CIRCL hashlookup (no key) - NIST NSRL-backed clean-file database
# ---------------------------------------------------------------------------

function Invoke-CIRCLHashlookupCheck {
    param([string] $Hash)

    $resp = Invoke-TIRequest -Uri "https://hashlookup.circl.lu/lookup/sha256/$Hash"

    if (-not $resp) {
        # Invoke-RestMethod returns $null on 404; this is expected for unknown hashes
        Emit-Event 'sha256' $Hash 'circl_hashlookup' @{
            result = 'not_in_known_clean_db'
            note   = 'not_catalogued_as_clean_software'
        } 'unknown'
        return
    }

    $fileName = [string](Get-SafeProp $resp 'FileName')
    if ($fileName.Length -gt 200) { $fileName = $fileName.Substring(0, 200) }

    Emit-Event 'sha256' $Hash 'circl_hashlookup' @{
        circl_file_name   = $fileName
        circl_file_size   = (Get-SafeProp $resp 'FileSize')
        circl_product     = (Get-SafeProp $resp 'ProductCode')
        circl_os          = (Get-SafeProp $resp 'OpSystemCode')
        circl_known_clean = 'true'
    } 'clean'
}

# ---------------------------------------------------------------------------
# API: URLScan.io (key required)
# ---------------------------------------------------------------------------

function Invoke-URLScanCheck {
    param([string] $Indicator, [string] $IocType, [string] $ApiKey)
    if (-not $ApiKey) { return }

    $query = 'page.url:' + $Indicator
    if ($IocType -eq 'domain') { $query = 'domain:' + $Indicator }

    $resp = Invoke-TIRequest `
        -Uri     'https://urlscan.io/api/v1/search/' `
        -Headers @{ 'API-Key' = $ApiKey } `
        -Query   @{ q = $query; size = '1' }

    if (-not $resp) { Emit-Error $IocType $Indicator 'urlscan' 'request_failed'; return }

    $resultsVal = Get-SafeProp $resp 'results'
    $results    = @()
    if ($null -ne $resultsVal) { $results = @($resultsVal) }

    if ($results.Count -eq 0) {
        Emit-Event $IocType $Indicator 'urlscan' @{ result = 'not_found' } 'unknown'
        return
    }

    $entry   = $results[0]
    $page    = Get-SafeProp $entry 'page'
    $verdObj = Get-SafeProp $entry 'verdicts'
    $overall = $null
    if ($null -ne $verdObj) { $overall = Get-SafeProp $verdObj 'overall' }

    $score     = Get-SafeInt  $overall 'score'
    $malicious = $false
    $cats      = @()

    if ($null -ne $overall) {
        $malBool = Get-SafeProp $overall 'malicious' $false
        if ($malBool) { $malicious = $true }
        $catsVal = Get-SafeProp $overall 'categories'
        if ($null -ne $catsVal) { $cats = @($catsVal) }
    }

    $verdict = 'clean'
    if ($malicious)        { $verdict = 'malicious'  }
    elseif ($score -gt 50) { $verdict = 'suspicious' }

    $pageCountry = ''
    $pageServer  = ''
    $pageIp      = ''
    $pageTitle   = ''

    if ($null -ne $page) {
        $pageCountry = [string](Get-SafeProp $page 'country')
        $pageServer  = [string](Get-SafeProp $page 'server')
        $pageIp      = [string](Get-SafeProp $page 'ip')
        $pageTitle   = [string](Get-SafeProp $page 'title')
    }

    if ($pageServer.Length -gt 100) { $pageServer = $pageServer.Substring(0, 100) }
    if ($pageTitle.Length  -gt 100) { $pageTitle  = $pageTitle.Substring(0, 100)  }

    Emit-Event $IocType $Indicator 'urlscan' @{
        urlscan_score      = $score
        urlscan_malicious  = $malicious
        urlscan_categories = ($cats -join ',')
        urlscan_country    = $pageCountry
        urlscan_server     = $pageServer
        urlscan_ip         = $pageIp
        urlscan_title      = $pageTitle
        urlscan_scan_id    = (Get-SafeProp $entry '_id')
    } $verdict
}

# ---------------------------------------------------------------------------
# Orchestration
# ---------------------------------------------------------------------------

function Invoke-IndicatorCheck {
    param(
        [string]    $Indicator,
        [string]    $IocType,
        [hashtable] $ApiKeys
    )

    $vtKey      = $ApiKeys.VT_API_KEY
    $abuseKey   = $ApiKeys.ABUSEIPDB_API_KEY
    $urlscanKey = $ApiKeys.URLSCAN_API_KEY

    switch ($IocType) {
        'ip' {
            $dns = Invoke-OsDnsLookup $Indicator
            if ($dns.Count -gt 0) { Emit-Event 'ip' $Indicator 'os_dns'   $dns 'unknown' }

            $wh = Invoke-OsWhois $Indicator
            if ($wh.Count -gt 0)  { Emit-Event 'ip' $Indicator 'os_whois' $wh  'unknown' }

            Invoke-VTIpCheck             $Indicator $vtKey
            Invoke-AbuseIPDBCheck        $Indicator $abuseKey
            Invoke-ShodanInternetDBCheck $Indicator
            Invoke-IPinfoCheck           $Indicator
            Invoke-GreyNoiseCheck        $Indicator
        }
        'domain' {
            $dns = Invoke-OsDnsLookup $Indicator
            if ($dns.Count -gt 0) { Emit-Event 'domain' $Indicator 'os_dns'   $dns 'unknown' }

            $wh = Invoke-OsWhois $Indicator
            if ($wh.Count -gt 0)  { Emit-Event 'domain' $Indicator 'os_whois' $wh  'unknown' }

            Invoke-VTDomainCheck $Indicator $vtKey
            Invoke-URLScanCheck  $Indicator 'domain' $urlscanKey
        }
        'url' {
            try {
                $uri    = New-Object System.Uri($Indicator)
                $domain = $uri.Host
                if ($domain) {
                    $dns = Invoke-OsDnsLookup $domain
                    if ($dns.Count -gt 0) { Emit-Event 'url' $Indicator 'os_dns' $dns 'unknown' }
                }
            } catch {}

            Invoke-VTUrlCheck   $Indicator $vtKey
            Invoke-URLScanCheck $Indicator 'url' $urlscanKey
        }
        'sha256' {
            Invoke-VTHashCheck          $Indicator $vtKey
            Invoke-CIRCLHashlookupCheck $Indicator
        }
    }
}

function Invoke-CheckBatch {
    param(
        [string[]]  $RawIndicators,
        [hashtable] $ApiKeys
    )

    $tasks = [System.Collections.Generic.List[hashtable]]::new()

    foreach ($raw in $RawIndicators) {
        # Strip stray commas that appear when calling from a Unix shell with
        # comma-separated arguments: pwsh script.ps1 -Indicators a, b
        # The shell passes 'a,' as one token and 'b' as another.
        $cleaned = $raw.Trim().Trim(',')
        if (-not $cleaned) { continue }

        $result = Get-IndicatorType $cleaned
        if (-not $result) {
            Emit-Event 'unknown' $cleaned 'validation' @{ error = 'unrecognized_or_malformed_indicator' } 'error'
            continue
        }
        if ($result.Type -eq 'ip_private') {
            Emit-Event 'ip_private' $cleaned 'validation' @{ note = 'private_reserved_or_loopback_address_skipped' } 'skip'
            continue
        }
        $tasks.Add(@{ Indicator = $result.Value; IocType = $result.Type })
    }

    foreach ($task in $tasks) {
        try {
            Invoke-IndicatorCheck -Indicator $task.Indicator -IocType $task.IocType -ApiKeys $ApiKeys
        } catch {
            Write-Host "ERROR processing $($task.Indicator): $_" -ForegroundColor Red
        }
    }
}

# ---------------------------------------------------------------------------
# Interactive menu
# ---------------------------------------------------------------------------

function Show-ApiKeyStatus {
    param([hashtable] $ApiKeys)
    Write-Host "`nAPI Key Status:" -ForegroundColor Cyan
    foreach ($k in $ApiKeys.Keys) {
        if ($ApiKeys[$k]) {
            Write-Host "  ${k}: loaded" -ForegroundColor Green
        } else {
            Write-Host "  ${k}: MISSING (checks using this key will be skipped)" -ForegroundColor Yellow
        }
    }
}

function Start-InteractiveMenu {
    param([hashtable] $ApiKeys)

    Write-Host @"

============================================================
  $SCRIPT_NAME v$SCRIPT_VERSION
  Multi-Source Threat Intelligence Checker
  Output: Splunk key=value (stdout)
============================================================
"@ -ForegroundColor Cyan

    while ($true) {
        Write-Host @"

Options:
  [1] Check a single indicator
  [2] Check multiple indicators (space or comma separated)
  [3] Check indicators from a file (one per line)
  [4] Show API key status
  [0] Exit
"@ -ForegroundColor White

        $choice = Read-Host "`nSelect option"

        switch ($choice.Trim()) {
            '0' {
                Write-Host "Exiting." -ForegroundColor Cyan
                return
            }
            '1' {
                $raw = Read-Host "Enter indicator (IP, domain, URL, or SHA256 hash)"
                if ($raw.Trim()) {
                    Invoke-CheckBatch -RawIndicators @($raw.Trim()) -ApiKeys $ApiKeys
                }
            }
            '2' {
                $raw        = Read-Host "Enter indicators (space or comma separated)"
                $indicators = ($raw -split '[,\s]+') |
                              Where-Object { $_.Trim() } |
                              ForEach-Object { $_.Trim() }
                if ($indicators) {
                    Invoke-CheckBatch -RawIndicators $indicators -ApiKeys $ApiKeys
                }
            }
            '3' {
                $path = (Read-Host "Enter path to indicator file").Trim()
                if (Test-Path $path) {
                    $lines = Get-Content $path |
                             Where-Object { $_.Trim() -and -not $_.TrimStart().StartsWith('#') } |
                             ForEach-Object { $_.Trim() }
                    if ($lines) {
                        Invoke-CheckBatch -RawIndicators $lines -ApiKeys $ApiKeys
                    }
                } else {
                    Write-Host "ERROR: File not found: $path" -ForegroundColor Red
                }
            }
            '4' {
                Show-ApiKeyStatus $ApiKeys
            }
            default {
                Write-Host "Invalid option. Please enter 0, 1, 2, 3, or 4." -ForegroundColor Yellow
            }
        }
    }
}

# ---------------------------------------------------------------------------
# Entry point
# ---------------------------------------------------------------------------

$apiKeys = Get-ThreatIntelConfig -ConfigPath $Config

switch ($PSCmdlet.ParameterSetName) {
    'Direct' {
        if ($Indicators -and $Indicators.Count -gt 0) {
            Invoke-CheckBatch -RawIndicators $Indicators -ApiKeys $apiKeys
        } else {
            Start-InteractiveMenu -ApiKeys $apiKeys
        }
    }
    'FromFile' {
        if (-not (Test-Path $File)) {
            Write-Host "ERROR: File not found: $File" -ForegroundColor Red
            exit 1
        }
        $lines = Get-Content $File |
                 Where-Object { $_.Trim() -and -not $_.TrimStart().StartsWith('#') } |
                 ForEach-Object { $_.Trim() }
        if ($lines) {
            Invoke-CheckBatch -RawIndicators $lines -ApiKeys $apiKeys
        }
    }
    'Menu' {
        Start-InteractiveMenu -ApiKeys $apiKeys
    }
}